Fallos del tipo CWE-122

3195 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2026-55005HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-3516HIGHHeap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via EPSS 1.0%CVE-2026-91098HIGHHP Linux Imaging and Printing (HPLIP) Software– Multiple VulnerabilitiesEPSS 1.0%CVE-2022-0518MEDIUMHeap-based Buffer Overflow in radareorg/radare2EPSS 1.0%CVE-2024-38032HIGHMicrosoft Xbox Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-9019LOWtcpreplay tcpprep cidr.c mask_cidr6 heap-based overflowEPSS 1.0%CVE-2026-69276CRITICALMicrosoft UxTheme Library (uxtheme.dll) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-6246CRITICALWyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-69493CRITICALWindows Event Logging Service Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-69431CRITICALTelnet Client Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-3712HIGHATEN LCD KVM over IP Switch CL5708IM - Heap-based Buffer OverflowEPSS 1.0%CVE-2025-3713HIGHATEN LCD KVM over IP Switch CL5708IM - Heap-based Buffer OverflowEPSS 1.0%CVE-2024-8948MEDIUMMicroPython objint.c mpz_as_bytes heap-based overflowEPSS 1.0%CVE-2017-7908—A heap-based buffer overflow exists in the third-party product Gigasoft, v5 and prior, included in GE Communicator 3.15 and prior. A malicioEPSS 1.0%CVE-2025-49757HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-21330HIGHOpen Management Infrastructure (OMI) Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2024-43518HIGHWindows Telephony Server Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-36896HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 1.0%CVE-2022-30540HIGHHorner Automation Cscape CsfontEPSS 1.0%CVE-2023-36417HIGHMicrosoft SQL OLE DB Remote Code Execution VulnerabilityEPSS 1.0%